Unauthenticated Firmware Upload in Netis Router Web Interface

Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability that allows unauthenticated attackers to submit unsigned firmware images by exploiting a missing authentication enforcement flaw in the Boa web server and netis.cgi CGI dispatcher. Attackers can send a multipart POST request to /cgi-bin/upload_fw.cgi without a valid session cookie, bypassing authentication because Boa grants access to any path containing '.cgi' regardless of cookie validation, and netis.cgi reads but does not enforce the authentication state before invoking the firmware update handler, which accepts images validated only by a forgeable additive checksum and static product strings rather than a cryptographic signature, potentially enabling persistent router compromise.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-73673 exposes a critical authentication bypass vulnerability in Netis NC63 router firmware that allows attackers to upload unsigned firmware images without any credentials. The flaw exists in the Boa web server's improper handling of authentication checks for CGI scripts—specifically, the server grants access to any path containing '.cgi' without validating session cookies. This means an attacker can directly POST malicious firmware to /cgi-bin/upload_fw.cgi from the internet, completely bypassing the router's access controls. Netis routers are widely deployed in enterprise and small business environments, making this a high-impact vulnerability (CVSS 8.8) that could allow remote attackers to gain complete device control, modify network traffic, or use compromised routers as pivot points into protected networks.

Casky's platform maps this vulnerability to MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access), identifying 283 relevant security skills that Claude AI uses with extended reasoning to detect attack patterns. When analyzing network traffic and web server logs, Casky would flag unauthenticated multipart POST requests to CGI upload endpoints lacking valid session tokens—a clear deviation from expected authentication flows. Practitioners using Casky would see findings highlighting suspicious firmware update attempts from external sources, missing or invalid authentication headers on sensitive admin functions, and anomalous CGI handler behavior in web server configurations. The platform's skill mapping enables detection of both the attack execution (unauthorized file upload) and the underlying authentication bypass mechanism, allowing security teams to identify compromised routers or active exploitation attempts in their environments before malicious firmware execution occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-73673.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-73673

Casky has 283 skills that investigate the attack patterns behind CVE-2026-73673. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn